A data access processing method, device and equipment

Abstract

The present invention provides a data access processing method, device and equipment, which are applied to a proxy node, and the method includes: obtaining an access request from an external system to a target service node, wherein the target service node is located on a blockchain network inside a cluster; obtaining an internal address of the target service node according to the access request; and forwarding the access request to the target service node inside the cluster according to the internal address. The scheme of the present invention can realize the cross-network formation of a peer-to-peer P2P network of blockchain service nodes deployed in different private networks.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a data access processing method, device and equipment. Background Art

[0002] In the cloud management of Kubernetes (K8S) environment management, calls between services are made through the short domain name (cluster domain name) within the cluster. This short domain name can only be used within the cluster, and external access subjects cannot access it through the short domain name. In some business scenarios, internal services need to be exposed to external access subjects. You can use the service exposure component provided by K8S to expose internal services outside the cluster.

[0003] In the blockchain BaaS platform based on the K8S environment, the platform provides blockchain services. First, multiple organizations are created, and each organization corresponds to multiple service nodes (taking ChainMaker as an example, there is one or more consensus nodes and a certificate node); a service node is represented by a POD and Service in K8S, and multiple service nodes form a P2P network. A blockchain network is established and smart contracts are deployed on the established P2P network to provide blockchain services to users.

[0004] If the entire blockchain network is deployed in the same K8S cluster or the same accessible network, then there is no need for a proxy. However, in most scenarios, the blockchain network is deployed in a private K8s cluster of an enterprise, that is, K8s is deployed in the enterprise intranet. This limits the service nodes in the blockchain network from forming a P2P network across enterprises, making it impossible for blockchain services to cross enterprises. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a data access processing method, device and equipment to solve the problem of networking across different networks in the scenario where service nodes in the blockchain platform change dynamically.

[0006] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0007] A data access processing method, applied to a proxy node, comprising:

[0008] Obtaining an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster;

[0009] According to the access request, obtaining the internal address of the target service node;

[0010] According to the internal address, the access request is forwarded to a target service node within the cluster.

[0011] Optionally, obtaining an internal address of a target service node according to the access request includes:

[0012] According to the access request, resolve and obtain the external domain name of the access request;

[0013] Determine the number of requests for accessing data of the current external domain name according to the external domain name;

[0014] According to the request quantity, the internal address of the target service node is obtained through the domain name mapping rule.

[0015] Optionally, according to the access request, resolving and obtaining an external domain name of the access request includes:

[0016] According to the access request, obtaining a transmission protocol of the access request;

[0017] According to the transmission protocol, the corresponding protocol parsing plug-in is called to obtain the external domain name.

[0018] Optionally, the internal address of the target service node is obtained through domain name mapping rules, including:

[0019] Get the stored service mapping data;

[0020] According to the service mapping data, the internal address corresponding to the external domain name of the current access request is obtained.

[0021] Optionally, the service mapping data is updated in real time, including:

[0022] Get the newly added service nodes marked with domain name labels in the cluster;

[0023] The internal address of the newly added service node is stored, and the mapping data is updated.

[0024] Optionally, the data access processing method further includes:

[0025] The data traffic obtained after the external system accesses the target service node is copied, and the copied data traffic is sent to the target port.

[0026] The present invention also provides a data access processing system, comprising:

[0027] The proxy node is located in the cluster and is used to obtain access requests from external systems to target service nodes and send the access requests to the target service nodes;

[0028] A domain name resolution module is used to perform domain name resolution on access requests from external systems to obtain the external domain name of the access request;

[0029] The current limiting and fusing module is used to determine whether to perform current limiting and fusing according to the number of requests for access data of the current external domain name;

[0030] A rule self-discovery module, used to map external domain names to internal addresses based on stored service mapping data;

[0031] A service group, located within a cluster, includes at least one service node.

[0032] The present invention also provides a data access processing device, comprising:

[0033] An acquisition module, used to obtain an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster;

[0034] The forwarding module is used to obtain the internal address of the target service node according to the access request; and forward the access request to the target service node within the cluster according to the internal address.

[0035] The present invention also provides a computing device, comprising: a processor and a memory storing a computer program, wherein when the computer program is run by the processor, the method as described above is executed.

[0036] The present invention also provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute the above method.

[0037] The above solution of the present invention includes at least the following beneficial effects:

[0038] The above scheme of the present invention obtains an access request from an external system to a target service node, and the target service node is located on the blockchain network inside the cluster; obtains the internal address of the target service node according to the access request; and forwards the access request to the target service node inside the cluster according to the internal address. It can realize the cross-network establishment of a peer-to-peer P2P network of blockchain service nodes deployed in different private networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 is a flow chart of a data access processing method according to an embodiment of the present invention;

[0040] Figure 2 is a schematic diagram of a model of a data access processing system according to an embodiment of the present invention;

[0041] Figure 3 It is a structural diagram of a data access processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0043] like Figure 1 As shown, an embodiment of the present invention proposes a data access processing method, which is applied to a proxy node, comprising:

[0044] Step 11, obtaining an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster;

[0045] Step 12, obtaining the internal address of the target service node according to the access request;

[0046] Step 13: forward the access request to a target service node within the cluster according to the internal address.

[0047] In this embodiment, the method based on the existing reverse proxy only supports static rule configuration, and it is impossible to dynamically configure the reverse proxy service according to dynamic rules. Instead, a new reverse proxy component applied to the K8s (short for Kubernetes, an open source container orchestration engine) environment is proposed to solve the problem that in some scenarios, access ports are restricted, other protocols other than the HTTP protocol cluster need to be proxied, and proxy rules, current limiting, and fuse mechanisms need to be dynamically configured. It supports dynamic proxy, self-discovery of proxy rules, support for multiple protocols, only occupies one restricted port, and supports conventional proxy features.

[0048] like Figure 2 As shown, in the above method of the present invention, a service in a service group corresponds to a service node in a blockchain, and the proxy node forwards the access request of the external system to the target service node inside the K8s cluster.

[0049] In an optional embodiment of the present invention, step 12, obtaining the internal address of the target service node according to the access request, includes:

[0050] Step 121, according to the access request, resolve and obtain the external domain name of the access request;

[0051] Step 122, determining the number of requests for accessing data of the current external domain name according to the external domain name;

[0052] Step 123: According to the request quantity, the internal address of the target service node is obtained through the domain name mapping rule.

[0053] In this embodiment, for external access requests, the domain name resolution module resolves the external domain name of the external access request, and then the current limiting and fusing module determines whether current limiting processing and fusing are required based on the access data of the current external domain name, and performs corresponding processing if necessary. When it is determined that fusing is not required, the proxy node obtains the internal service information to be forwarded from the rule self-discovery module, including the cluster domain name, IP address and port information of the internal service. Then the request is forwarded to the corresponding cluster internal service, and the response result is returned.

[0054] In an optional embodiment of the present invention, step 121, according to the access request, parsing to obtain the external domain name of the access request includes:

[0055] Step 1211, obtaining a transmission protocol of the access request according to the access request;

[0056] Step 1212: According to the transmission protocol, the corresponding protocol resolution plug-in is called to obtain the external domain name.

[0057] In this embodiment, the domain name resolution module calls different protocol resolution plug-ins to obtain the domain name for external access according to the protocol type used. For example, when the HTTP protocol is used, the domain name is obtained according to the Host field in the request header; when the TLS protocol is used, the domain name is obtained according to the TLS certificate.

[0058] In an optional embodiment of the present invention, step 123, obtaining the internal address of the target service node through the domain name mapping rule, includes:

[0059] Step 1231, obtaining stored service mapping data;

[0060] Step 1232: Obtain the internal address corresponding to the external domain name of the current access request according to the service mapping data.

[0061] In this embodiment, the rule self-discovery module stores the cluster domain name or IP address and port information of the monitored target service. When the proxy node needs it, the address of the internal service node mapped to the external domain name will be sent to the proxy node so that the proxy node can forward the request to the target service node.

[0062] In an optional embodiment of the present invention, the service mapping data is updated in real time, including:

[0063] Get the newly added service nodes marked with domain name labels in the cluster;

[0064] The internal address of the newly added service node is stored, and the mapping data is updated.

[0065] In this embodiment, the rule self-discovery module can automatically discover the services that need to be proxied. When the service configuration with the domain tag is monitored to take effect, the corresponding domain name and service cluster domain name will be automatically obtained, saved, and provided to the proxy module for use.

[0066] In an optional embodiment of the present invention, the present invention further includes:

[0067] The data traffic obtained after the external system accesses the target service node is copied, and the copied data traffic is sent to the target port.

[0068] In this embodiment, a traffic mirroring function is also provided. When the traffic mirroring function is enabled, a copy of the traffic is sent to the mirrored traffic processing interface for processing.

[0069] The present invention also provides a data access processing system, comprising:

[0070] The proxy node is located in the cluster and is used to obtain access requests from external systems to target service nodes and send the access requests to the target service nodes;

[0071] A domain name resolution module is used to perform domain name resolution on access requests from external systems to obtain the external domain name of the access request;

[0072] The current limiting and fusing module is used to determine whether to perform current limiting and fusing according to the number of requests for access data of the current external domain name;

[0073] A rule self-discovery module, used to map external domain names to internal addresses based on stored service mapping data;

[0074] A service group, located within a cluster, includes at least one service node.

[0075] In this embodiment, the specific functions corresponding to the above modules are as follows:

[0076] Implementation of the proxy module:

[0077] The reverse proxy system implemented by this method is a four-layer proxy system, and the proxy module implements the proxy logic and the main control logic of the entire system. The implementation of the proxy logic is to obtain the request, obtain the information of the forwarding target service, and forward the request to the target service as it is.

[0078] Rule self-discovery module implementation:

[0079] When a service is created, it is determined whether the service has a domain tag; if so, it means that the service needs to be proxied. This module obtains the cluster domain name or IP address and port information of the target service and saves it.

[0080] Implementation of domain name protocol parsing module:

[0081] HTTP protocol:

[0082] For HTTP requests, the domain name to be forwarded is obtained directly from the Host field in the request header information;

[0083] TLS security protocol suite:

[0084] For the TLS security protocol cluster (such as HTTPS, GPRCS, WSS, etc.), it is necessary to monitor the TLS connection establishment process and parse the domain name from the certificate field of the first TLS handshake message.

[0085] Implementation of current limiting module:

[0086] The system will put tokens into the bucket at a constant rate. A token agent is allowed to process the number of requests. If there is a request that needs to be processed, it is necessary to get a token from the bucket first. When there are not enough tokens in the bucket to process the request, the request will be placed in a waiting queue or directly rejected (fuse).

[0087] The above method of the present invention uses a proxy to solve the problem of networking across different networks. When these service nodes in the BaaS platform are dynamically created or deleted according to the business, or expanded according to business pressure, the proxy configuration can be dynamically updated and the proxy system that needs proxy service in K8s can be automatically discovered to support the business needs of building a blockchain network across networks. At the same time, the blockchain network uses multiple protocols (P2P, GRPC, HTTP, etc.), and the proxy node can also proxy multiple protocols.

[0088] The above method of the present invention meets the reverse proxy requirements in scenarios with more restricted conditions, and can mainly achieve the following functions:

[0089] 1. Dynamic proxy: Proxy configuration can be updated dynamically without restarting the proxy system;

[0090] 2. Rule self-discovery: The proxy can automatically discover the service information that the K8s cluster needs to proxy, without manually adding proxy rules;

[0091] 3. Multi-protocol: Support multiple protocols, such as HTTP, GPRC, P2P and their security protocols, such as HTTPS, GPRCS, etc.;

[0092] 4. Domain name-based proxy rules: Identify proxy services based on domain names, occupying only one service port;

[0093] 5. Current limiting and fuse: Support proxy current limiting and fuse mechanism;

[0094] 6. Traffic mirroring: supports traffic mirroring function to meet the needs of traffic analysis and security monitoring.

[0095] The above method of the present invention can provide more flexible proxy services, and the proxy system can provide self-management and self-discovery services, support multiple protocols and support the extension functions of the protocols.

[0096] like Figure 3 As shown, the present invention also provides a data access processing device 30, comprising:

[0097] An acquisition module 31 is used to obtain an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster;

[0098] The forwarding module 32 is used to obtain the internal address of the target service node according to the access request; and forward the access request to the target service node within the cluster according to the internal address.

[0099] Optionally, obtaining an internal address of a target service node according to the access request includes:

[0100] According to the access request, resolve and obtain the external domain name of the access request;

[0101] Determine the number of requests for accessing data of the current external domain name according to the external domain name;

[0102] According to the request quantity, the internal address of the target service node is obtained through the domain name mapping rule.

[0103] Optionally, according to the access request, resolving and obtaining an external domain name of the access request includes:

[0104] According to the access request, obtaining a transmission protocol of the access request;

[0105] According to the transmission protocol, the corresponding protocol parsing plug-in is called to obtain the external domain name.

[0106] Optionally, the internal address of the target service node is obtained through domain name mapping rules, including:

[0107] Get the stored service mapping data;

[0108] According to the service mapping data, the internal address corresponding to the external domain name of the current access request is obtained.

[0109] Optionally, the service mapping data is updated in real time, including:

[0110] Get the newly added service nodes marked with domain name labels in the cluster;

[0111] The internal address of the newly added service node is stored, and the mapping data is updated.

[0112] Optionally, the data access processing method further includes:

[0113] The data traffic obtained after the external system accesses the target service node is copied, and the copied data traffic is sent to the target port.

[0114] It should be noted that the device is a device corresponding to the above method, and all implementation methods in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects.

[0115] An embodiment of the present invention provides a computing device, comprising: a processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method described above is executed. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0116] The embodiment of the present invention further provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute the above method. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0117] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0118] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0119] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0121] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0122] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0123] In addition, it should be noted that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it is understood that all or any steps or components of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or a network of computing devices in hardware, firmware, software or a combination thereof, which can be achieved by those of ordinary skill in the art using their basic programming skills after reading the description of the present invention.

[0124] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general device. Therefore, the purpose of the present invention can also be achieved by simply providing a program product containing a program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order. Some steps can be performed in parallel or independently of each other.

[0125] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data access processing method, characterized in that: Applicable to proxy nodes, including: Obtaining an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster; According to the access request, obtaining the internal address of the target service node; forwarding the access request to a target service node within the cluster according to the internal address; Wherein, obtaining the internal address of the target service node according to the access request includes: According to the access request, resolve and obtain the external domain name of the access request; Determine the number of requests for accessing data of the current external domain name according to the external domain name; Determine whether to perform current limiting and fusing according to the number of requests, and if not, obtain the internal address of the target service node through the domain name mapping rule; Wherein, according to the access request, the external domain name of the access request is parsed and obtained, including: According to the access request, obtaining a transmission protocol of the access request; According to the transmission protocol, the corresponding protocol parsing plug-in is called to obtain the external domain name; when the transmission protocol is the HTTP hypertext transfer protocol, the external domain name is obtained according to the Host field of the request header; when the transmission protocol is the TLS transport layer security protocol, the external domain name is obtained according to the TLS transport layer security protocol certificate; The internal address of the target service node is obtained through the domain name mapping rule, including: Get the stored service mapping data; According to the service mapping data, an internal address corresponding to the external domain name of the current access request is obtained; the internal address includes the cluster domain name, IP address and port information of the internal service node; The service mapping data is updated in real time, including: Get the newly added service nodes marked with domain name labels in the cluster; Storing the internal address of the newly added service node and updating the mapping data; The domain name tag is a domain tag. When the service configuration with the domain tag is detected to be effective, the cluster domain name, IP address and port information of the newly added service node are automatically obtained. The data access processing method further includes: The data traffic obtained after the external system accesses the target service node is copied, and the copied data traffic is sent to the target port.

2. A data access processing system, characterized in that: include: The proxy node is located in the cluster and is used to obtain access requests from external systems to target service nodes and send the access requests to the target service nodes; A domain name resolution module is used to perform domain name resolution on access requests from external systems to obtain the external domain name of the access request; The current limiting and fusing module is used to determine whether to perform current limiting and fusing according to the number of requests for access data of the current external domain name; A rule self-discovery module, used to map external domain names to internal addresses based on stored service mapping data; A service group, located in a cluster, includes at least one service node; The domain name resolution is performed on the access request to the external system to obtain the external domain name of the access request, including: According to the access request, obtaining a transmission protocol of the access request; According to the transmission protocol, the corresponding protocol parsing plug-in is called to obtain the external domain name; when the transmission protocol is the HTTP hypertext transfer protocol, the external domain name is obtained according to the Host field of the request header; when the transmission protocol is the TLS transport layer security protocol, the external domain name is obtained according to the TLS transport layer security protocol certificate; Among them, according to the stored service mapping data, the external domain name is mapped to the internal address, including: Get the stored service mapping data; According to the service mapping data, an internal address corresponding to the external domain name of the current access request is obtained; the internal address includes the cluster domain name, IP address and port information of the internal service node; The service mapping data is updated in real time, including: Get the newly added service nodes marked with domain name labels in the cluster; Storing the internal address of the newly added service node and updating the mapping data; The domain name tag is a domain tag. When the service configuration with the domain tag is detected to be effective, the cluster domain name, IP address and port information of the newly added service node are automatically obtained. The data access processing system also copies the data traffic obtained after the external system accesses the target service node, and sends the copied data traffic to the target port.

3. A data access processing device, characterized in that: include: An acquisition module, used to obtain an access request from an external system to a target service node, where the target service node is located on a blockchain network within the cluster; A forwarding module, configured to obtain an internal address of a target service node according to the access request; and forward the access request to the target service node within the cluster according to the internal address; Wherein, obtaining the internal address of the target service node according to the access request includes: According to the access request, resolve and obtain the external domain name of the access request; Determine the number of requests for accessing data of the current external domain name according to the external domain name; Determine whether to perform current limiting and fusing according to the number of requests, and if not, obtain the internal address of the target service node through the domain name mapping rule; Wherein, according to the access request, the external domain name of the access request is parsed and obtained, including: According to the access request, obtaining a transmission protocol of the access request; According to the transmission protocol, the corresponding protocol parsing plug-in is called to obtain the external domain name; when the transmission protocol is the HTTP hypertext transfer protocol, the external domain name is obtained according to the Host field of the request header; when the transmission protocol is the TLS transport layer security protocol, the external domain name is obtained according to the TLS transport layer security protocol certificate; The internal address of the target service node is obtained through the domain name mapping rule, including: Get the stored service mapping data; According to the service mapping data, an internal address corresponding to the external domain name of the current access request is obtained; the internal address includes the cluster domain name, IP address and port information of the internal service node; The service mapping data is updated in real time, including: Get the newly added service nodes marked with domain name labels in the cluster; Storing the internal address of the newly added service node and updating the mapping data; The domain name tag is a domain tag. When the service configuration with the domain tag is detected to be effective, the cluster domain name, IP address and port information of the newly added service node are automatically obtained. The forwarding module can also be used to: The data traffic obtained after the external system accesses the target service node is copied, and the copied data traffic is sent to the target port.

4. A computing device, characterized in that include: A processor and a memory storing a computer program, wherein when the computer program is executed by the processor, the method according to claim 1 is performed.

5. A computer-readable storage medium, characterized in that: Instructions are stored, which, when executed on a computer, cause the computer to perform the method as claimed in claim 1.

Images